GDPR Privacy Notice - Heartwood Vets

Heartwood Vets is committed to protecting and respecting your privacy. This GDPR privacy notice explains why and how we collect data from you, and how it is used by us. As a UK-based small animal veterinary practice, we adhere to the UK General Data Protection Regulation (UK GDPR) and related data protection laws.

Why We Collect Your Personal Data and What We Do With It

When you register your pet or pets with Heartwood Vets, your data is stored and processed for the following reasons:
We need to collect your personal information in order to provide you with the veterinary services you have requested, such as consultations, treatments, vaccinations, and surgeries, to keep your pets happy and healthy.
This request and our agreement to provide veterinary services constitutes a contract, and we will therefore require the ability to process your data in order to fulfil this contract and provide services to the standards expected by The Royal College of Veterinary Surgeons (RCVS).

Please note that UK GDPR legislation pertains only to data on people and not animals. Pet details are collected as part of our service but are not subject to GDPR in the same way.

We collect, store, and process this information based on a 'Legitimate Interest' and 'Medical Interest' because without it, we would be unable to provide you with veterinary services, such as:​

 

• Reminders for annual vaccinations, health checks, blood tests, etc. (although the responsibility to keep them up to date remains with you).

• Emergency treatments. 

• Progress reports on your pets' recovery.

We may also occasionally send you newsletters or information that we feel would benefit the health and wellbeing of your pets and could be of interest to you as the owner. You may withdraw this consent at any time by clicking the unsubscribe option at the top or bottom of each email, or by emailing info@heartwoodvets.co.uk.
Personal data may be provided to Heartwood Vets in a number of ways, including directly from you (via email, post, in person, or our website), recommendations, or forwarding of relevant information from associated parties (such as other veterinary practices). 

What Personal Data We Collect

We may collect the following types of personal data:​

 

• Contact details (name, address, phone number, email). 

• Pet ownership details (linked to your contact information). 

• Payment information (for billing purposes).

• Health-related information about you or your pet where relevant to services (e.g., allergies or medical history that affects treatment).

• Any other information you provide voluntarily.

Legal Basis for Processing

Our processing is based on:​

 

• Contractual necessity (to provide veterinary services).

• Legitimate interests (to operate our practice efficiently and improve services).

• Consent (for marketing communications, which can be withdrawn at any time).

• Legal obligations (e.g., record-keeping for veterinary medicines).

Retention Period

The record-keeping requirements for Veterinary Medicinal Products (VMPs) are set out in the Veterinary Medicines Regulations (VMRs). Records of the retail supply (which includes administration) of POM-V and POM-VPS medicines must be kept for 5 years.
It is Heartwood Vets' policy to retain your records, including vaccination records, for 5 years after the completion of the last veterinary procedure. After this time, you can request that we delete your records if you wish. You may do this by contacting our team by phone, email info@heartwoodvets.co.uk, or in person. If we are not requested to delete your records, they may be retained indefinitely to provide better service at a later date without needing to recollect personal data.

Storage

Your records are stored electronically on our Practice Management Software ‘Lupa’ which is a secure cloud-based system with appropriate safeguards and back-up facilities. Hard copies are not routinely stored long term and are disposed of appropriately. 

 

Payment details are processed by our card payment provider ‘Dojo’ which is a PCI-DSS accredited provider. 

 

Sharing Your Data with Third Parties

 

We will never share your data with any third party without your prior written or verbal consent. Only the following people/agencies may have access to your data: 

 

• Members of the Heartwood Vets team, to provide you with services.

• IT service providers who manage our systems and servers. 

• Government agencies or regulatory bodies (e.g., RCVS) if required by law or for fulfilment of our professional obligations.

• Other veterinary practices (e.g., for referrals or transfers).

• Non-veterinary partner businesses (e.g. behaviourist, hydrotherapy, crematorium for referrals or transfers). 

• Insurance companies (with your consent, for claims processing).

• Debt collection agencies (if necessary for unpaid bills). 

 

All of our third party providers are contractually obliged to comply with UK GDPR standards. 

 

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

 

• Access: You can request a copy of the data we hold about you (Subject Access Request). We will respond within one month.

• Rectification: Request correction of inaccurate or incomplete data.

• Erasure: Request deletion of your data in certain circumstances (e.g., when no longer needed).

• Restriction: Request restriction of processing in specific cases.

• Objection: Object to processing based on legitimate interests or for marketing.

• Data Portability: Request transfer of your data to another provider.

• Withdraw Consent: At any time, where processing is based on consent.

To exercise these rights, contact us at info@heartwoodvets.co.uk or via our website contact form. We will respond within one calendar month.

Under RCVS guidelines, clinical and client records are the property of Heartwood Vets in the interests of animal welfare and our protection. However, you have the right to access this information. If you change vets, we can provide copies of relevant records upon request.